RHSA-2020:4031 - Security Advisory

Topic

An update for freerdp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

The following packages have been upgraded to a later upstream version: freerdp (2.1.1). (BZ#1834286)

Security Fix(es):

• freerdp: Out of bound read in cliprdr_server_receive_capabilities (CVE-2020-11018)
• freerdp: Out of bound read/write in usb redirection channel (CVE-2020-11039)
• freerdp: out-of-bounds read in update_read_icon_info function (CVE-2020-11042)
• freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function (CVE-2020-11047)
• freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)
• freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c (CVE-2020-13397)
• freerdp: Out of bound read in update_recv could result in a crash (CVE-2020-11019)
• freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)
• freerdp: Out of bound access in clear_decompress_subcode_rlex (CVE-2020-11040)
• freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu (CVE-2020-11041)
• freerdp: out of bound read in rfx_process_message_tileset (CVE-2020-11043)
• freerdp: double free in update_read_cache_bitmap_v3_order function (CVE-2020-11044)
• freerdp: out of bounds read in update_read_bitmap_data function (CVE-2020-11045)
• freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read (CVE-2020-11046)
• freerdp: out-of-bounds read could result in aborting the session (CVE-2020-11048)
• freerdp: out-of-bound read of client memory that is then passed on to the protocol parser (CVE-2020-11049)
• freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read (CVE-2020-11058)
• freerdp: out-of-bounds read in cliprdr_read_format_list function (CVE-2020-11085)
• freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function (CVE-2020-11086)
• freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage (CVE-2020-11087)
• freerdp: out-of-bounds read in ntlm_read_NegotiateMessage (CVE-2020-11088)
• freerdp: out-of-bounds read in irp functions (CVE-2020-11089)
• freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)
• freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)
• freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later (CVE-2020-11526)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1834286 - Update freerdp to 2.1.1
• BZ - 1835382 - CVE-2020-11042 freerdp: out-of-bounds read in update_read_icon_info function
• BZ - 1835391 - CVE-2020-11044 freerdp: double free in update_read_cache_bitmap_v3_order function
• BZ - 1835399 - CVE-2020-11045 freerdp: out of bounds read in update_read_bitmap_data function
• BZ - 1835403 - CVE-2020-11046 freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read
• BZ - 1835762 - CVE-2020-11047 freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function
• BZ - 1835766 - CVE-2020-11048 freerdp: out-of-bounds read could result in aborting the session
• BZ - 1835772 - CVE-2020-11049 freerdp: out-of-bound read of client memory that is then passed on to the protocol parser
• BZ - 1835779 - CVE-2020-11058 freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read
• BZ - 1836223 - CVE-2020-11522 freerdp: out-of-bounds read in gdi.c
• BZ - 1836239 - CVE-2020-11525 freerdp: out-of-bounds read in bitmap.c
• BZ - 1836247 - CVE-2020-11526 freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later
• BZ - 1841189 - CVE-2020-13396 freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.
• BZ - 1841196 - CVE-2020-13397 freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c
• BZ - 1844161 - CVE-2020-11085 freerdp: out-of-bounds read in cliprdr_read_format_list function
• BZ - 1844166 - CVE-2020-11086 freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function
• BZ - 1844171 - CVE-2020-11087 freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage
• BZ - 1844177 - CVE-2020-11088 freerdp: out-of-bounds read in ntlm_read_NegotiateMessage
• BZ - 1844184 - CVE-2020-11089 freerdp: out-of-bounds read in irp functions
• BZ - 1848008 - CVE-2020-11018 freerdp: Out of bound read in cliprdr_server_receive_capabilities
• BZ - 1848012 - CVE-2020-11019 freerdp: Out of bound read in update_recv could result in a crash
• BZ - 1848018 - CVE-2020-11038 freerdp: Integer overflow in VIDEO channel
• BZ - 1848022 - CVE-2020-11039 freerdp: Out of bound read/write in usb redirection channel
• BZ - 1848029 - CVE-2020-11040 freerdp: Out of bound access in clear_decompress_subcode_rlex
• BZ - 1848034 - CVE-2020-11041 freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu
• BZ - 1848038 - CVE-2020-11043 freerdp: out of bound read in rfx_process_message_tileset

CVEs

• CVE-2020-11018
• CVE-2020-11019
• CVE-2020-11038
• CVE-2020-11039
• CVE-2020-11040
• CVE-2020-11041
• CVE-2020-11042
• CVE-2020-11043
• CVE-2020-11044
• CVE-2020-11045
• CVE-2020-11046
• CVE-2020-11047
• CVE-2020-11048
• CVE-2020-11049
• CVE-2020-11058
• CVE-2020-11085
• CVE-2020-11086
• CVE-2020-11087
• CVE-2020-11088
• CVE-2020-11089
• CVE-2020-11522
• CVE-2020-11525
• CVE-2020-11526
• CVE-2020-13396
• CVE-2020-13397

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index